[Bug] Safeguards False Positive: reasoning_extraction on benign request

it continues BELOW after that:

---

❯ what model should i use?

⏺ Sonnet 5.5's safeguards stopped the response above · continuing once with that noted

⏺ API Error: Sonnet 5.5's safeguards flagged this message (https://www.anthropic.com/legal/aup). This sometimes happens with safe, normal conversations. Claude Code can't respond to this message with Sonnet 5.5.

Double press esc to edit your last message, or try a different model with /model.

Send feedback with /feedback or learn more: https://support.claude.com/en/articles/8106465

Details: [reasoning_extraction]

Request ID: req_011Cg532q6aoSwshRg9MoL3y

Message ID: msg_011Cg532qYNhHW4NrcPWYEWo

✻ Brewed for 3s · done 9:18 AM

❯ why

⏺ Sonnet 5.5's safeguards stopped the response above · continuing once with that noted

⏺ API Error: Sonnet 5.5's safeguards flagged this message (https://www.anthropic.com/legal/aup). This sometimes happens with safe, normal conversations. Claude Code can't respond to this message with Sonnet 5.5.

Double press esc to edit your last message, or try a different model with /model.

Send feedback with /feedback or learn more: https://support.claude.com/en/articles/8106465

Details: [reasoning_extraction]

Request ID: req_011Cg533kkBkGkSZjZS4JwGB

Message ID: msg_011Cg533mV5NYfY14TSn5TVM

✻ Baked for 3s · done 9:19 AM

After manually setting the /model to Haiku 5.5 Effort:LOW

---

❯ /model
⎿ Set model to Haiku 5.5 and saved as your default for new sessions

❯ /effort
⎿ Set effort level to low (saved as your default for new sessions): Quick, straightforward implementation with minimal overhead

❯ what model should i use and why?

For this work I'd use Sonnet 5.5, not Haiku. Your current setting is Haiku 5.5 at low effort, which I'd change.

Why Sonnet 5.5

• The M1 work is multi-repo, multi-step CI and git work: rehearsal runs, PR threads, board posts, and reviews that must check exact heads. That needs reliable tool use over long sessions.
• Haiku is good for mechanical edits and quick lookups. It tends to skim, and that's the wrong failure mode for review and verification, where a missed defect can invalidate evidence.
• Opus 5.5 is worth it only for hard architecture or security judgment, such as the approval-gate design or the freeze decisions. For routine fixes it's slower and costlier than the task needs.

Effort

• Low effort is fine for quick lookups.
• For reviews, test-first fixes, and rehearsal analysis, I'd use medium. Low effort is where I'd be most likely to skip a verification step.

Your recall request
The earlier response on your graph-design-guide question was stopped by a safety classifier. That was a false positive on a normal recall of your own documents, and I won't reproduce the withheld text. The lookup itself is straightforward, and I can redo it cleanly on Sonnet. So far I've confirmed:

• The copy in the iCloud One-Markdown folder is identical to the Codex copy.
• The closest related material is the 2026-10-09 loop/graph research set and the graph-policy contract in orama-system.

Should I switch back to Sonnet 5.5 at medium effort and finish the comparison, or do the #2 and #5 plan first?

✻ Churned for 9s · done 9:20 AM

Follow-up from a long multi-day engineering session (since about 2026-10-14). New limitations observed, in addition to the safeguard false positive above:

1. Safeguard false positives repeat in one session. Benign requests to recall and summarize the user's own documents were stopped several times in a row, including after the user rephrased them. The stop message reports reasoning_extraction, which does not describe the request.
2. Tool availability changes mid-session. The Grep tool was not present in the session, so searches fell back to git grep through Bash. Two MCP servers failed to connect with CONNECTION_CLOSED, and one GitHub plugin returned HTTP 400 on its auth header.
3. Harness rules block common patterns. A foreground sleep chain is blocked and must use run_in_background or a Monitor loop. Long foreground commands time out at 120 seconds. A PreToolUse plugin hook blocks some Bash commands that name log files or ignored paths, even for read-only use.
4. Auto-mode classifier denies state changes on connected apps (for example, toggling a pull request between draft and ready) when no matching user rule exists. The denial is reasonable, but the session cannot ask for a narrow permission rule mid-task, so the change is left for the user.
5. Model switches mid-session change behaviour. Switching to a lower tier at low effort mid-task produced shallower verification.

These are observations for the classifier and tooling reports; no specific fix is requested.